38 ms·

How the GDPR Will Disrupt Google and Facebook

371 points by cpeterso 9y ago

AJRF 9y ago
I'm going to read thoroughly through the terms and conditions and get a case going in European Courts when this comes into play, because you know for a FACT Google and Facebook will put in some vague term to let them collect data for "future" improvement of the service. Watch and see.
- phatbyte 9y ago
  I believe that's what EU is trying to achieve: > “A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”
- kbart 9y ago
  Vague terms and conditions is even against current EU laws which mandates to state specific use cases for your personal data.
fixermark 9y ago
So, how long until this one also also gets neutered when European governments realize they can't even bring their own websites into compliance with the new law? ;)
- ISL 9y ago
  The Man will often exempt himself.
  - james_pm 9y ago
    The provisions are already there, just waiting to be used. National security, secrecy, etc.
- deleted 9y ago
  [deleted]
- the_mitsuhiko 9y ago
  Which websites do you have in mind here?
- kartan 9y ago
  > So, how long until this one also also gets neutered when European governments realize they can't even bring their own websites into compliance with the new law? ;) I have worked for 2 big tech companies in Europe. And in both, there is a big effort to make sure that they are compliant with the legislation. I see everyone taking it seriously. Why do you think that it is going to fail? Even the stupid, really really stupid, cookie warning was implemented everywhere. What does this different? (A part of being actually a good law that protects citizens from indiscriminate tracking).
  - fixermark 9y ago
    Regarding the cookie warning, I was mostly thinking about this infographic humorously describing the delta between what was originally intended and what was eventually implemented [https://silktide.com/app/uploads/2013/01/Cookie-Law-infographic-reduced-size.png https://silktide.com/app/uploads/2013/01/Cookie-Law-infograp...]. As well as the ICO back-pedaling from explicit consent to implied consent (https://www.out-law.com/articles/2013/january/ico-to-change-cookie-policy-to-recognise-implied-consent/ https://www.out-law.com/articles/2013/january/ico-to-change-...). I take it the actual implementation went a bit more smoothly than the infographic suggests?
- M2Ys4U 9y ago
  They'd have a tough time doing so; this is a Regulation (as opposed to a Directive) which means the legislation is written by the EU and applies in all EU territories automatically without being transcribed into national legislation. That means in order for it to be changed then the European Commission would have to propose a new law, and the European Parliament and Council of the European Union will have to agree to it. The former doesn't really care about whether national governments can get on with their jobs or not.
Animats 9y ago
Site will not render properly with Google Analytics blocked. Web site renders with text on top of text. Grey on black text. Is this some fake site by a Google front intended to give this idea a bad reputation?
- prophesi 9y ago
  I use uMatrix on Chrome and have every non-pagefair.com script blocked, including google analytics. Not seeing any site rendering issues here. Perhaps it's your browser?
  - hedora 9y ago
    My adblocker blocks the base url of the page. Maybe there is some common adblock regexp that matches stuff on this site.
    - eppsilon 9y ago
      That would make sense, as PageFair is an ad network: https://pagefair.com/about-us/ https://pagefair.com/about-us/
danarmak 9y ago
> Nor can they deny access to their services to users who refuse to opt-in to tracking.[1] Taken literally this means it's illegal to provide a service in exchange for tracking. Can someone elaborate on whether this is true and what else it applies to or what else other business models are made outright illegal?
- dordoka 9y ago
  I guess that sentence is referencing article 43. IANAL. See http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...
  - danarmak 9y ago
    Article 43: > In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. (My italics.) The second sentence seems clear: "consent is presumed not to be freely given" if the service could be provided without the consent. Which means consent cannot be traded in exchange for an unrelated service, like e.g. webmail. I'm not sure what the relation between the two sentences is. Does the second one ("consent is presumed...") apply only to the cases addressed by the first, i.e. "where there is a clear imbalance"? Or are they independent?
    - dordoka 9y ago
      Again IANAL and not english native speaker, but my understanding is that they are not independent. Consent is presumed not to be freely given IF it does not allow..., OR IF the performance...
CobrastanJorji 9y ago
> The critical question for both businesses is whether users will click “yes”, when asked to consent. Yes, users will click yes on basically anything. Facebook could put up a message that says "In order to proceed, click yes to give us half the money in your checking account" and the majority of Facebook users will still click through. Look at EU cookie warnings. Did any of those warnings noticeably impact anybody's traffic after the first week?
- mattmanser 9y ago
  Cookie warnings is a bad example as it was widely acknowledged by anyone vaguely techy that they'd got it completely wrong from the start.
  - ben_jones 9y ago
    Eh, couldn't you make the argument that the Cookie warnings showed that a government body could meaningfully change the experience of the internet? As small as the warnings are, had anything like it been done before?
    - foota 9y ago
      Sure, now we get annoying warnings on every website we visit....
      - kuschku 9y ago
        Because the UK intentionally built a loophole into their version of the law. The actual original cookie law, that was decided on EU level, requires users actually to be able to opt out. But it was a directive, and so countries could interpret it for local implementations. The GDPR is a regulation, which means its text is directly law, and it also means it can be a lot stricter.
        grabeh 9y ago
        Not so much a loophole but the UK Information Commissioner certainly adopted a more relaxed approach to enforcement of the requirements of the cookie law compared to other countries. And the law required prior informed consent to cookies with opt-out not generally being considered to be valid consent.
hedora 9y ago
Sweet. How to I inform google that I moved to europe (even though I didn't)? VPN tunnel?
- s17n 9y ago
  If you want to opt out of data collection, it's not that hard, just go to google.com/privacy
  - confounded 9y ago
    What does this definition of "opt-out" mean?
    - deleted 9y ago
      [deleted]
    - microcolonel 9y ago
      The code in their tracker stub (always inlined as a <script> tag) is rendered inoperable.
  - curiousDog 9y ago
    But GDPR is more than that right? I can tell Google to delete everything it knows about me, not just start opting out.
    - jpadkins 9y ago
      you can already do that at https://myaccount.google.com/ https://myaccount.google.com/
      - Nala_Alan 9y ago
        Do you actually believe it will delete anything? You're wrong. NSA would still get the data, and so would Google for marketing purposes. It's just to calm privacy-aware, but not techsavvy users.
0x27081990 9y ago
Google and Facebook will find a way. Problem are small/young startups
- goodplay 9y ago
  Beginning with a partial solution to this problem is better than doing nothing at all. This sad state of affairs has gone on for far too long.
- FridgeSeal 9y ago
  The more I think about it, the more I feel that if you're a startup, thinking about this from the get-go won't hurt you and won't really cost you. What I mean by that is, it's easier to build your db and backups to comply with these laws before you have anything set in stone, than after you have any meaningful amount of personal data. Like, if you organise your backups and db to happily be able to handle removal of requested data before you accrue too much technical debt/inertia then you're going to be ahead of anyone who has to retrofit, which in many ways actually puts you at an advantage. Also, I for one won't be mourning the loss of the business model that parasitically lives of exploiting user data.
- kbart 9y ago
  What problems? So you can't collect all the data on your costumers and do with it as you see fit? And when it gets leaked just say: "Oops, sorry"? If for some startups taking private data seriously is a "problem", I want to see them burn in fire.
Sephr 9y ago
The author believes that users have little incentive to allow Google to provide personalized Google Search results. I don't think any technical-oriented people in this thread would agree that they have "little incentive" to allow Google Search personalization. When I turn off Google Search personalization, I get inferior search results that are less likely to be what I was searching for. If you don't want your results personalized, there is an option in the search results to turn personalization off. The problem I have with this law is that Google will need to default to non-personalized results and then prompt users if they want personalization. Google probably doesn't want to increase UI friction, so they will most likely just disable personalization and not prompt to enable. This will result in less-engaged users and inferior search results for the average EU citizen.
- balls187 9y ago
  > I don't think any technical-oriented people in this thread would agree that they have "little incentive" to allow Google Search personalization. I disagree. I turned off Search personalization a long time ago, and haven't looked back.
  - Jordrok 9y ago
    Same here. I do most of my browsing in an incognito mode-like environment (so no persistent cookies or sign in to my Google account), and even when I am signed in I turned off the search history a long time ago.
- Nala_Alan 9y ago
  I don't even use Google, I use my own searx instance instead. Completely unpersonalized, and completely private. And I feel that it's better this way, cause privacy does matter.
  - austinheap 9y ago
    I just use my old Britannica CDs. Completely private.
shadowtree 9y ago
And if you think GDPR is a toothless joke, let's take a look at the defined fine stucture. It is pretty simple, only 3 levels (strikes for the fellow Americans): Strike 1 - Stern warning letter Strike 2 - 2% of your TOTAL GLOBAL REVENUE Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) And now you know why GDPR is a board level topic. Keep in mind that the EU/US Safe Harbor agreement got axed due to a lawsuit of a single student from Vienna against Facebook. So all you need is a single pissed off German customer you ignored when asking for their data report card and you're fucked. For startups - GDPR is like Y2K at the time, a GOLDMINE. So much opportunity to sell solutions, from real to snake oil. GDPR compliance is already and will continue to trigger a massive wave of investment. Enjoy :)
- xd 9y ago
  Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) Why would they impose a 20M limit and not stick to 4% revenue irregardless of it... edit: I'm not sure that the down voting is about.. it's still a limit, a limit that means a company turning over 0-500M will pay up to a 20M fine.. not so bad the closer you get to 500M but not so great if you're a small company, especially so as the regulation is so open to the "law of unintended consequences" right now and only larger companies will have the funds / man power to navigate it.
  - deleted 9y ago
    [deleted]
  - ATsch 9y ago
    You seem to misunderstand, 20M is not a limit, but a minimum
  - downrightmike 9y ago
    A lower limit, a minimum. If 4% is 20.1M+ they'll pay that.
  - jpk 9y ago
    I understand your point, but I still think it's wrong. The minimum on the third strike is so a little-to-no revenue startup or shell company or something doesn't willingly abuse data because the fine will be 4% of nothing.
deleted 9y ago
[deleted]
bflesch 9y ago
I see this as yet another tax on (European) startups who have to invest even more resources into regulatory compliance. This prohibition of freely using all available data will create great arbitrage opportunity for the shadow economy, and will have a net negative effect on innovation. I think prohibition has very bad side effects, and that MORE transparency is the way forward in politics, economy, and also society. This includes allowing businesses to use all the data they can get their hands on. People can produce infinitely more data than any google can realistically process. I cannot understand why people who are otherwise for transparency and against prohibition are celebrating this as a big win against FB/AMZ/GOOG, as those players can easily shell out another $10M here and there to be compliant with this regulatory monster.
- usgroup 9y ago
  This is about ethics primarily. If you don't care about ethics then expect an unethical economy.
  - bflesch 9y ago
    I don't think it is about ethics, it is about control. We as European businessmen were and still are unable to generate the same kind of innovation as the US, and now they try to solve the problem by pulling down the US on our level (at least the parts concerning the EU market). I think this is the wrong approach, EU should try to make it easier for European businesses to compete with US-based ones. But in the end we have another layer of bureaucracy on top of all the things a US startup has to worry about, and those mostly non-technical/non-innovative people want to be a part of the picture.
    - kartan 9y ago
      > We as European businessmen were and still are unable to generate the same kind of innovation as the US Tracking people around the internet. To follow them everywhere they go and save their personal information, their political ideology, etc. It is not innovation, that's just stepping over personal rights. > I don't think it is about ethics, it is about control. Yes. About giving back control of citizen privacy to the citizens themselves. It is not the government that decides who can own your data or when to delete it. It is European citizens that decide individually who should have their data and whom can not. > EU should try to make it easier for European businesses to compete with US-based ones. If you give away freedom for economic gain, you don't deserve either one.
raimue 9y ago
In case you are puzzled the same way as me, GDPR stands for General Data Protection Regulation.
mankash666 9y ago
Are all companies beholden to this or those with legal entities in Europe. For instance, can a Chinese company with ZERO legal presence in the EU completely ignore these requirements? The internet has no real borders, after-all.
- the_mitsuhiko 9y ago
  > can a Chinese company with ZERO legal presence in the EU completely ignore these requirements? Same with an American company with no legal presence in the EU. However quite a few things require you to establish one. Likewise if you are engaging in B2B activities your European customers will ask you for it.
- M2Ys4U 9y ago
  Yes. If you process the personal data people in the EU then you have to comply: Article 3 Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.
_pdp_ 9y ago
This has nothing to do with the size of your company/startup and it has nothing to do with regulatory compliance. It is a pretty simple at its core: if your company/startup gets breached and as a result PII data leaked, then you are liable for the penalty according to the general rules. I don't think anybody will argue this is a bad thing. If anything, it will help companies to be a little bit more careful with what sort of data they collect because frankly, at the moment almost every company is perhaps guilty of collecting far too much personal data under the assumption that one day it may become useful. If you collect PII data then you are liable for damages if you happen to mishandle it. So here is how to avoid the GDPR penalties. 1. Get compliant - it is pretty much ISO27001 and it will cost you money 2. Don't collect excessive PII data and if you do, store it securely - after all it is a very basic ask 3. Avoid collecting PII data at all cost - think of it as another form of PCI Frankly, there is no need to panic.
Chaebixi 9y ago
How might one make sure their accounts get classified those that fall under the scope of the GDPR regulation? Would it be sufficient to set your location to an EU country?
- deleted 9y ago
  [deleted]
antoncohen 9y ago
I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. I get the desire to have a company forget about you, and remove all the personal information they have. It makes sense from a personal standpoint. But how do you do it technically? If you follow GDPR strictly you would need to be able to purge the data from your backups. Now most backups are considered immutable, so you aren't going to do that, meaning you need a way to ensure that "forgotten" users never get restored. But how do you even delete the live data? Does the tech company you work for have the ability to delete all traces of a user from their system, cleaning severing all relationships with other objects in your system? Do you have the ability to retrieve everything you know about a specific user, and provide it to them? You will need to write the code to do this. There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. Do you sell a SaaS service to businesses, and those businesses send you their customer's data? Then you are the processor and they are the controller. Cool, less for you to do, sort of. Except that controller must agree to every sub-processor you use. Want to switch from AWS to GCP? You can only do it if all your customers agree. Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission. You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers.
- nvarsj 9y ago
  > it comes at a huge cost to tech companies Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? I think that's sort of the point - that your business should not rely on tracking individuals and selling that information without their consent to gov/private bodies. It's obviously a huge change, since so many big tech players rely on this to make profits. But the internet will be a much nicer place for everyone else if right to privacy is protected.
cinquemb 9y ago
Might be easier for small niche companies with no offices in the EU but willing EU customers to ask for payment via a cryptocurrency. It just seems to me in the long run, more and more laws like this will pop up, and using cryptocurrencies will get easier/ more familiar.
- rspeer 9y ago
  Nobody is going to look for SaaS on the black market, unless the service they're looking for was illegal to start with.
  - cinquemb 9y ago
    >unless the service they're looking for was illegal to start with. Luckily, we will always know of everything that was/is legal now will be illegal in the future, and that people/companies throughout history will always submit to the costs of regulatory compliance of all governments in the world, no matter how burdensome they may be in specific instances.
yuhong 9y ago
I have been thinking that the ad bubble is a problem for a while now. Ads are basically to encourage consumption, and the US economy has been debt based for decades now.
davidgerard 9y ago
We [technology dept at a non-computer business in the UK] got the lecture about this at work. Turns out geeks are fans of this approach! I've been using "GDPR hazard" as a useful way to kill bad ideas at work. "Sure you can do that! We just need you to confirm that your business unit accepts responsibility for this user-identifying data and ... oh, we can delete it? I'll do that now then." We have lots of user-identified data, going back years. I can't see it as a bad thing for us to behave properly with regard to it, and to be required to do so.
andrei_says_ 9y ago
Just wondering, would an European residing in the US be able to request EU compliance for their data?
mdip 9y ago
My first instinct was to be pretty happy about these laws, which surprised me quite a bit. I generally identify on the libertarian/pro-capitalist side of things and "as a general rule" subscribe to the belief that government regulations are often more problematic than problem solving[0]. So I had to take a moment to analyse why I felt this way. Here's the problem as I see it: I know all of the things that are collected, how they're collected, what shady practices are used[1] and I'm completely aware that there is no anonymity left on the internet. The old "when the product is free, you're the product" isn't lost on me. In reading this, though, I was still finding myself a little outraged[2]. I look at it this way: if yesterday, we had an web with plain old "dumb advertising" techniques limited in sophistication in the manner of television advertising in the 90s, and today we ended up with this, there would be rioting (in the USA, anyway[3]). This didn't necessarily happen slowly but it happened gradually and quietly. I remember when Facebook announced that it was adding the ability to track you on other sites that you visited while you were logged out -- that was announced and it was met with criticism (briefly, though I quit the platform about a month later in a quiet, personal, revolt). Here's the thing - if you ask an average non-technical individual if they understand that they're being tracked on the internet, they'll shrug and say "yes". If you dig a little deeper, you'll discover that they haven't the faintest idea how deeply they're being tracked and that they don't even have an analogy in their own lives to equate that tracking to. I couldn't come up with anything to describe the extent of tracking short of extremely lengthy explanations of what's being done and used[4]. And then there's me - I understand I'm being tracked and have basically chosen the head-in-the-sand approach. I use adblock, and a few extensions that supposedly "limit tracking" (doubtful) but I know they're worthless. Here's the thing, though, what choice do we have? And that's where I concluded how I was able to land in favor of some form of regulation on this behavior[5]. It is becoming increasingly impossible to avoid interacting with companies like Google and Facebook[6]. I look at it this way -- a company that becomes a monopoly in such an important industry can exert as much, if not more, control over the citizenry than their own government[7] but without the limitations imposed by democracy. What should be done? I'm not sure. Self-regulation isn't working. I have zero faith in government crafting any kind of law related to technology that won't be some combination of horribly ineffective, worse than what we have today, utterly breaks something really important, or is used as a means to insert something horrible (watch them try to pop in a line-item around key-escrow). I'm kind of surprised to find myself thinking that approach that looks the best, out of the options, is probably forced-competition through breaking up the companies involved and I hate that idea in principal and in practice -- it's worked just-about as well in the past. [0] I don't want this to devolve into a flame-war of whether regulating is "good or not", though I fear I may have just stoked that flame, I'm simply providing background for contextual purposes. [1] I half- admire the creative uses of WebRTC with STUN on what are otherwise regarded as highly reputable major news sites. It's difficult for me to not see that practice as poking a hole in my firewall and I feel no less outrage when I see that happening than I do when a piece of malware does the same thing. [2] Part of me had forgotten the idea that when GMail was "scanning e-mails for advertising purposes", they were scanning e-mails that were coming inbound from non-GMail users who couldn't have possibly consented to that. I'm sure there's a really good counter argument, but I'd have a hard time not feeling a little violated by that practice if I weren't a GMail user, already. [3] Probably elsewhere, but my experience is that some European countries' citizens (particularly the UK, where I have the most experience outside of the US) are more tolerant to this sort of thing whereas when I was a child, you'd have seen people gathering in militias the moment the government tried to propose something like Real ID. [4] I can only speak anecdotally since I had this conversation with family members who are non-technical and after about two hours, had them quite disgusted -- asking how is that legal ... and these are some of the most government-skeptical conservative people you'd ever meet. [5] And I have zero faith in the US government being able to craft a law that works. Minimally the "they must still offer the service if the user opts out" will be removed, entirely, turning the "agree to be tracked" button into the moral equivalent of the "Cookie Warning" -- something you click because you have to. And philosophically, if we weren't talking about monopolies or near-monopolies here, I'd agree with that approach. [6] Yes, DuckDuckGo is my default search engine, everywhere. And I've now trained myself to use the shortcut to get to google for the 60-70% of searches that DDG returns unworkable results. I think it's my search patterns, which tend to be very narrow in results, causing Bing/DDG to "broaden" and ignore terms (or when used with parameters, simply yield nothing). My parents (both retired) use DDG and rarely anything else since I switched all of their browsers around (they didn't even realize I had changed it -- they don't think of Google as a company, they think of search as something "the internet just has ..."). They are perfectly happy with it. [7] Or can work in concert with it. Requirements to hand over Facebook credentials at the border are becoming common. I'm waiting for the day when I say "yeah, I don't use that" and end up back in a little room with an angry looking man asking me a bunch of (the same; slightly rephrased) questions and responding to them with the assumption that I'm lying (personal experience on that one; not fun). I mean, after all, I'm a programmer/live on the internet/et. al., surely I must use Facebook and I'm trying to hide something! /s
mzzter 9y ago
What does the first footnote mean? > "Nor can they deny access to their services to users who refuse to opt-in to tracking.[1]" > "[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1. See Recital 42’s reference to “without detriment”, Recital 43’s discussion of “freely given” consent, and Article 7(2) prohibition of conditionality. See also the UK Information Commissioner’s Office’s draft guidance on consent, 31 March 2017, p. 21, which clearly prohibits so-called “tracking walls”." What, in this regulation, prevents the company from denying users (who opt out) access to a service they provide free of charge or a downgraded experience? And how would a court measure the level of service?
- taysic 9y ago
  Im guessing they would force the company to make tracking not on by default but rather opt-in (lol)? But what's confusing is - if you clearly state how the data will be used upfront, do you need to offer an opt-out? What if your service simply doesn't work unless the data is used in a particular way?
  - grabeh 9y ago
    Under the GDPR one way to use data for purposes unrelated to the underlying service provision is to look to obtain consent. That is not opt-out consent but clear informed consent through opt-in. If your service won't work functionally without certain data then consent is not right ground of processing to rely on. There is a specific ground relating to processing necessary to provide a service. If your service isn't financially viable because you can't use data to obtain revenue to support the underlying service provision then consent may not be a viable ground because of the above reasons. The debate continues however on how to support free service provision outside of the confines of consent.
    - taysic 9y ago
      Interesting but complex. I could imagine there are a lot of issues on how to express your intent with the data. Some uses of data might be ancillary to the direct goal of the user but still unexpectedly useful. Interesting from the article: "purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”.[3]"
deleted 9y ago
[deleted]
fnord77 9y ago
I need to move to europe.
whyagaindavid 9y ago
Will GDPR allow me to delete my Apple-ID? Thanks
- virgilp 9y ago
  yes
throwaway91234 9y ago
Throwaway since I don't want to involve my employer. I actually work for a platform that is squarely in the GDPR crosshairs (digital marketing). There are a lot of things where our lawyers' perspective is different from what most people say here (I didn't talk directly to lawyers, but I presume product managers did). - You don't have to comply in 2018, you have to show that you started seriously working on a solution, even if you're not fully prepared. - You don't have to have automated processes for everything (e.g. delete from backups), it's actually perfectly reasonable to say "we'll process your request" and do it manually (ref: startups spending inordinate amounts of effort for GDPR compliance). - Opt-in is not as "game changer" as suggested here, my understanding is that you can do implicit consent (notify the user about what you do, give them a link to take action; crucially, that link might even be the link to your privacy policy which contains the link to the opt-out interface... if I got this right - and I think that I did - this may not amount to much more than a slightly modified "this site uses cookies" thingy). - Delete requests may be handled by "de-identification" (don't delete the data, delete the association with you). - Related to that, while I don't have a definitive answer, I strongly suspect that GDPR only applies to information that can be positively associated with you (e.g. authenticated activity). I'm not obliged to show you anonymous browser activity/information that I've probabilistically associated with you, for the simple reason that I might be wrong and I might disclose sensitive information (think about girlfriend looking up "what does Amazon know about me" and finding up that "she is interested in an engagement ring" because you anonymously browsed from her computer, thus spoiling your surprise even though you were careful to delete your browser history/ browse anonymously. Yes, incognito mode doesn't necessarily help you - we do efforts to identify server-side the incognito sessions and de-link them from the probabilistic marketing profiles, because we don't want to negatively-surprise the customers; but I suspect not all players are that careful). Overall... despite what many people think, I think big players are actually fairly careful/sensitive about your privacy (well, if we exclude Facebook here :D ). It's the startups that would concern me more... they have very little incentive to guard your data well, because there are so many OTHER reasons why they might fail, that "privacy disaster" is very low on their list of concerns.
1024core 9y ago
So, are ad clicks "personal data" ? That would basically destroy all adtech startups.
- brango 9y ago
  Yes, if you capture IPs/anonymous user IDs, perhaps user agents etc.
- gonmf 9y ago
  I'd imagine the host website needs to ask for the permission to share specific data with a third party named XYZ Startup, that will use that data for language/country segmentation or whatever is they do, and if the user denies that right then random ads are shown instead.
AriaMinaei 9y ago
While I see some of the concerns about the _technicality_ of the law as completely legitimate, it still bothers me that so many people reject the whole spirit of this law, and cannot put the negative of "tax on startups" against the much greater good of personal privacy. I've just started a business myself, and this regulation affects my company too. It makes development costlier; it'll take from the precious little time we have to spend on compliance paperwork rather than work on our core business. In the short run, it does hurt our chances of success. Yet, none of the trouble is even comparable to what's to be gained here. And it bothers me (though doesn't surprise me) that some people don't see that. It also bothers me that such vocal opposition barely comes up when the discussion is just about bigger companies such as Google and Facebook. How can we expect "un-evilness" from bigger companies when we're barely willing to do anything in that regard ourselves?
- fixermark 9y ago
  Possibly because personal privacy as a "much greater good" is open to debate. People place wildly differing values on that property. Google's current ecosystem of data-sharing means that Assistant can make educated context guesses on what I mean when I talk to it based on my browser history and map navigation history. If the new privacy constraints damage that passive interconnection, that's not a net good for me.
  - the_mitsuhiko 9y ago
    Then opt into collection. This does not disallow that.
  - AriaMinaei 9y ago
    > ... privacy as a "much greater good" is open to debate I agree, but that's a different topic, really. The comments here aren't about the (un)/importance of privacy. The main debate seems to be either about the technicality of the law and its possible unintended consequences, which are legitimate concerns, or they're about how "this is gonna make my job much harder," which is not really a legitimate concern in this context, and those comments were the ones I was talking about. > Google's current ecosystem of data-sharing means that Assistant can make educated context guesses on what I mean when I talk to it based on my browser history and map navigation history. If the new privacy constraints damage that passive interconnection, that's not a net good for me. I think we're overestimating a technical difficulty here, and downplaying a moral principle. Providing a personalised service without storing large amounts of personal information in a central location is not impossible. It's just technically harder to do. And even if it was impossible, then still, we need to sort out the moral consequences first. Not by banning technological progress of course, but perhaps by bringing more oversight to corporations. Or by making sure that people of lower socioeconomic background aren't hit harder than the wealthy.
sageikosa 9y ago
Cool. 88 more pages of functional specs on every project.
richrichardsson 9y ago
Would one way "around" this be, "Welcome to ABC Service, it costs X€/month to use, or if you allow us to use your data to sell to our advertisers we will waive this fee."?

371 points by cpeterso 9y ago

AJRF 9y ago

I'm going to read thoroughly through the terms and conditions and get a case going in European Courts when this comes into play, because you know for a FACT Google and Facebook will put in some vague term to let them collect data for "future" improvement of the service. Watch and see.

phatbyte 9y ago
I believe that's what EU is trying to achieve: > “A purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”
kbart 9y ago
Vague terms and conditions is even against current EU laws which mandates to state specific use cases for your personal data.

fixermark 9y ago

So, how long until this one also also gets neutered when European governments realize they can't even bring their own websites into compliance with the new law? ;)

ISL 9y ago
The Man will often exempt himself.
- james_pm 9y ago
  The provisions are already there, just waiting to be used. National security, secrecy, etc.
deleted 9y ago
[deleted]
the_mitsuhiko 9y ago
Which websites do you have in mind here?
kartan 9y ago
> So, how long until this one also also gets neutered when European governments realize they can't even bring their own websites into compliance with the new law? ;) I have worked for 2 big tech companies in Europe. And in both, there is a big effort to make sure that they are compliant with the legislation. I see everyone taking it seriously. Why do you think that it is going to fail? Even the stupid, really really stupid, cookie warning was implemented everywhere. What does this different? (A part of being actually a good law that protects citizens from indiscriminate tracking).
- fixermark 9y ago
  Regarding the cookie warning, I was mostly thinking about this infographic humorously describing the delta between what was originally intended and what was eventually implemented [https://silktide.com/app/uploads/2013/01/Cookie-Law-infographic-reduced-size.png https://silktide.com/app/uploads/2013/01/Cookie-Law-infograp...]. As well as the ICO back-pedaling from explicit consent to implied consent (https://www.out-law.com/articles/2013/january/ico-to-change-cookie-policy-to-recognise-implied-consent/ https://www.out-law.com/articles/2013/january/ico-to-change-...). I take it the actual implementation went a bit more smoothly than the infographic suggests?
M2Ys4U 9y ago
They'd have a tough time doing so; this is a Regulation (as opposed to a Directive) which means the legislation is written by the EU and applies in all EU territories automatically without being transcribed into national legislation. That means in order for it to be changed then the European Commission would have to propose a new law, and the European Parliament and Council of the European Union will have to agree to it. The former doesn't really care about whether national governments can get on with their jobs or not.

Animats 9y ago

Site will not render properly with Google Analytics blocked. Web site renders with text on top of text. Grey on black text. Is this some fake site by a Google front intended to give this idea a bad reputation?

prophesi 9y ago
I use uMatrix on Chrome and have every non-pagefair.com script blocked, including google analytics. Not seeing any site rendering issues here. Perhaps it's your browser?
- hedora 9y ago
  My adblocker blocks the base url of the page. Maybe there is some common adblock regexp that matches stuff on this site.
  - eppsilon 9y ago
    That would make sense, as PageFair is an ad network: https://pagefair.com/about-us/ https://pagefair.com/about-us/

danarmak 9y ago

> Nor can they deny access to their services to users who refuse to opt-in to tracking.[1] Taken literally this means it's illegal to provide a service in exchange for tracking. Can someone elaborate on whether this is true and what else it applies to or what else other business models are made outright illegal?

dordoka 9y ago
I guess that sentence is referencing article 43. IANAL. See http://data.consilium.europa.eu/doc/document/ST-5419-2016-INIT/en/pdf http://data.consilium.europa.eu/doc/document/ST-5419-2016-IN...
- danarmak 9y ago
  Article 43: > In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. (My italics.) The second sentence seems clear: "consent is presumed not to be freely given" if the service could be provided without the consent. Which means consent cannot be traded in exchange for an unrelated service, like e.g. webmail. I'm not sure what the relation between the two sentences is. Does the second one ("consent is presumed...") apply only to the cases addressed by the first, i.e. "where there is a clear imbalance"? Or are they independent?
  - dordoka 9y ago
    Again IANAL and not english native speaker, but my understanding is that they are not independent. Consent is presumed not to be freely given IF it does not allow..., OR IF the performance...

CobrastanJorji 9y ago

> The critical question for both businesses is whether users will click “yes”, when asked to consent. Yes, users will click yes on basically anything. Facebook could put up a message that says "In order to proceed, click yes to give us half the money in your checking account" and the majority of Facebook users will still click through. Look at EU cookie warnings. Did any of those warnings noticeably impact anybody's traffic after the first week?

mattmanser 9y ago
Cookie warnings is a bad example as it was widely acknowledged by anyone vaguely techy that they'd got it completely wrong from the start.
- ben_jones 9y ago
  Eh, couldn't you make the argument that the Cookie warnings showed that a government body could meaningfully change the experience of the internet? As small as the warnings are, had anything like it been done before?
  - foota 9y ago
    Sure, now we get annoying warnings on every website we visit....
    - kuschku 9y ago
      Because the UK intentionally built a loophole into their version of the law. The actual original cookie law, that was decided on EU level, requires users actually to be able to opt out. But it was a directive, and so countries could interpret it for local implementations. The GDPR is a regulation, which means its text is directly law, and it also means it can be a lot stricter.
      - grabeh 9y ago
        Not so much a loophole but the UK Information Commissioner certainly adopted a more relaxed approach to enforcement of the requirements of the cookie law compared to other countries. And the law required prior informed consent to cookies with opt-out not generally being considered to be valid consent.

hedora 9y ago

Sweet. How to I inform google that I moved to europe (even though I didn't)? VPN tunnel?

s17n 9y ago
If you want to opt out of data collection, it's not that hard, just go to google.com/privacy
- confounded 9y ago
  What does this definition of "opt-out" mean?
  - deleted 9y ago
    [deleted]
  - microcolonel 9y ago
    The code in their tracker stub (always inlined as a <script> tag) is rendered inoperable.
- curiousDog 9y ago
  But GDPR is more than that right? I can tell Google to delete everything it knows about me, not just start opting out.
  - jpadkins 9y ago
    you can already do that at https://myaccount.google.com/ https://myaccount.google.com/
    - Nala_Alan 9y ago
      Do you actually believe it will delete anything? You're wrong. NSA would still get the data, and so would Google for marketing purposes. It's just to calm privacy-aware, but not techsavvy users.

0x27081990 9y ago

Google and Facebook will find a way. Problem are small/young startups

goodplay 9y ago
Beginning with a partial solution to this problem is better than doing nothing at all. This sad state of affairs has gone on for far too long.
FridgeSeal 9y ago
The more I think about it, the more I feel that if you're a startup, thinking about this from the get-go won't hurt you and won't really cost you. What I mean by that is, it's easier to build your db and backups to comply with these laws before you have anything set in stone, than after you have any meaningful amount of personal data. Like, if you organise your backups and db to happily be able to handle removal of requested data before you accrue too much technical debt/inertia then you're going to be ahead of anyone who has to retrofit, which in many ways actually puts you at an advantage. Also, I for one won't be mourning the loss of the business model that parasitically lives of exploiting user data.
kbart 9y ago
What problems? So you can't collect all the data on your costumers and do with it as you see fit? And when it gets leaked just say: "Oops, sorry"? If for some startups taking private data seriously is a "problem", I want to see them burn in fire.

Sephr 9y ago

The author believes that users have little incentive to allow Google to provide personalized Google Search results. I don't think any technical-oriented people in this thread would agree that they have "little incentive" to allow Google Search personalization. When I turn off Google Search personalization, I get inferior search results that are less likely to be what I was searching for. If you don't want your results personalized, there is an option in the search results to turn personalization off. The problem I have with this law is that Google will need to default to non-personalized results and then prompt users if they want personalization. Google probably doesn't want to increase UI friction, so they will most likely just disable personalization and not prompt to enable. This will result in less-engaged users and inferior search results for the average EU citizen.

balls187 9y ago
> I don't think any technical-oriented people in this thread would agree that they have "little incentive" to allow Google Search personalization. I disagree. I turned off Search personalization a long time ago, and haven't looked back.
- Jordrok 9y ago
  Same here. I do most of my browsing in an incognito mode-like environment (so no persistent cookies or sign in to my Google account), and even when I am signed in I turned off the search history a long time ago.
Nala_Alan 9y ago
I don't even use Google, I use my own searx instance instead. Completely unpersonalized, and completely private. And I feel that it's better this way, cause privacy does matter.
- austinheap 9y ago
  I just use my old Britannica CDs. Completely private.

shadowtree 9y ago

And if you think GDPR is a toothless joke, let's take a look at the defined fine stucture. It is pretty simple, only 3 levels (strikes for the fellow Americans): Strike 1 - Stern warning letter Strike 2 - 2% of your TOTAL GLOBAL REVENUE Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) And now you know why GDPR is a board level topic. Keep in mind that the EU/US Safe Harbor agreement got axed due to a lawsuit of a single student from Vienna against Facebook. So all you need is a single pissed off German customer you ignored when asking for their data report card and you're fucked. For startups - GDPR is like Y2K at the time, a GOLDMINE. So much opportunity to sell solutions, from real to snake oil. GDPR compliance is already and will continue to trigger a massive wave of investment. Enjoy :)

xd 9y ago
Strike 3 - 4% of your TOTAL GLOBAL REVENUE (or 20mil EUR, whichever is higher) Why would they impose a 20M limit and not stick to 4% revenue irregardless of it... edit: I'm not sure that the down voting is about.. it's still a limit, a limit that means a company turning over 0-500M will pay up to a 20M fine.. not so bad the closer you get to 500M but not so great if you're a small company, especially so as the regulation is so open to the "law of unintended consequences" right now and only larger companies will have the funds / man power to navigate it.
- deleted 9y ago
  [deleted]
- ATsch 9y ago
  You seem to misunderstand, 20M is not a limit, but a minimum
- downrightmike 9y ago
  A lower limit, a minimum. If 4% is 20.1M+ they'll pay that.
- jpk 9y ago
  I understand your point, but I still think it's wrong. The minimum on the third strike is so a little-to-no revenue startup or shell company or something doesn't willingly abuse data because the fine will be 4% of nothing.

deleted 9y ago

[deleted]

bflesch 9y ago

I see this as yet another tax on (European) startups who have to invest even more resources into regulatory compliance. This prohibition of freely using all available data will create great arbitrage opportunity for the shadow economy, and will have a net negative effect on innovation. I think prohibition has very bad side effects, and that MORE transparency is the way forward in politics, economy, and also society. This includes allowing businesses to use all the data they can get their hands on. People can produce infinitely more data than any google can realistically process. I cannot understand why people who are otherwise for transparency and against prohibition are celebrating this as a big win against FB/AMZ/GOOG, as those players can easily shell out another $10M here and there to be compliant with this regulatory monster.

usgroup 9y ago
This is about ethics primarily. If you don't care about ethics then expect an unethical economy.
- bflesch 9y ago
  I don't think it is about ethics, it is about control. We as European businessmen were and still are unable to generate the same kind of innovation as the US, and now they try to solve the problem by pulling down the US on our level (at least the parts concerning the EU market). I think this is the wrong approach, EU should try to make it easier for European businesses to compete with US-based ones. But in the end we have another layer of bureaucracy on top of all the things a US startup has to worry about, and those mostly non-technical/non-innovative people want to be a part of the picture.
  - kartan 9y ago
    > We as European businessmen were and still are unable to generate the same kind of innovation as the US Tracking people around the internet. To follow them everywhere they go and save their personal information, their political ideology, etc. It is not innovation, that's just stepping over personal rights. > I don't think it is about ethics, it is about control. Yes. About giving back control of citizen privacy to the citizens themselves. It is not the government that decides who can own your data or when to delete it. It is European citizens that decide individually who should have their data and whom can not. > EU should try to make it easier for European businesses to compete with US-based ones. If you give away freedom for economic gain, you don't deserve either one.

raimue 9y ago

In case you are puzzled the same way as me, GDPR stands for General Data Protection Regulation.

mankash666 9y ago

Are all companies beholden to this or those with legal entities in Europe. For instance, can a Chinese company with ZERO legal presence in the EU completely ignore these requirements? The internet has no real borders, after-all.

the_mitsuhiko 9y ago
> can a Chinese company with ZERO legal presence in the EU completely ignore these requirements? Same with an American company with no legal presence in the EU. However quite a few things require you to establish one. Likewise if you are engaging in B2B activities your European customers will ask you for it.
M2Ys4U 9y ago
Yes. If you process the personal data people in the EU then you have to comply: Article 3 Territorial scope 1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not. 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. 3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.

_pdp_ 9y ago

This has nothing to do with the size of your company/startup and it has nothing to do with regulatory compliance. It is a pretty simple at its core: if your company/startup gets breached and as a result PII data leaked, then you are liable for the penalty according to the general rules. I don't think anybody will argue this is a bad thing. If anything, it will help companies to be a little bit more careful with what sort of data they collect because frankly, at the moment almost every company is perhaps guilty of collecting far too much personal data under the assumption that one day it may become useful. If you collect PII data then you are liable for damages if you happen to mishandle it. So here is how to avoid the GDPR penalties. 1. Get compliant - it is pretty much ISO27001 and it will cost you money 2. Don't collect excessive PII data and if you do, store it securely - after all it is a very basic ask 3. Avoid collecting PII data at all cost - think of it as another form of PCI Frankly, there is no need to panic.

Chaebixi 9y ago

How might one make sure their accounts get classified those that fall under the scope of the GDPR regulation? Would it be sufficient to set your location to an EU country?

deleted 9y ago
[deleted]

antoncohen 9y ago

I encourage a little more thought before cheering this on as a win. While GDPR isn't as ridiculous as the Cookie Law, it still shows that the EU/EC don't understand the technology they are trying to regulate, and it comes at a huge cost to tech companies. Take the right to be forgotten. First of all, it should be common sense that no one has the right to force legitimate news articles to disappear because they don't like the content, but that is what the EU has ruled should happen. I get the desire to have a company forget about you, and remove all the personal information they have. It makes sense from a personal standpoint. But how do you do it technically? If you follow GDPR strictly you would need to be able to purge the data from your backups. Now most backups are considered immutable, so you aren't going to do that, meaning you need a way to ensure that "forgotten" users never get restored. But how do you even delete the live data? Does the tech company you work for have the ability to delete all traces of a user from their system, cleaning severing all relationships with other objects in your system? Do you have the ability to retrieve everything you know about a specific user, and provide it to them? You will need to write the code to do this. There is a good chance your little startup that isn't cash flow positive will have to spend $1 million of its VC money on becoming GDPR compliant. Do you sell a SaaS service to businesses, and those businesses send you their customer's data? Then you are the processor and they are the controller. Cool, less for you to do, sort of. Except that controller must agree to every sub-processor you use. Want to switch from AWS to GCP? You can only do it if all your customers agree. Want to use try out a new metrics or logging service? If it will have any PII you can't do it without customer (controller) permission. You will basically need to hire full-time compliance officers to deal with this. The big tech companies already have compliance officers, but GDPR is so massively invasive to businesses that even small companies now need compliance officers.

nvarsj 9y ago
> it comes at a huge cost to tech companies Doesn't it just affect companies which rely heavily on lack of privacy for monetisation? I think that's sort of the point - that your business should not rely on tracking individuals and selling that information without their consent to gov/private bodies. It's obviously a huge change, since so many big tech players rely on this to make profits. But the internet will be a much nicer place for everyone else if right to privacy is protected.

cinquemb 9y ago

Might be easier for small niche companies with no offices in the EU but willing EU customers to ask for payment via a cryptocurrency. It just seems to me in the long run, more and more laws like this will pop up, and using cryptocurrencies will get easier/ more familiar.

rspeer 9y ago
Nobody is going to look for SaaS on the black market, unless the service they're looking for was illegal to start with.
- cinquemb 9y ago
  >unless the service they're looking for was illegal to start with. Luckily, we will always know of everything that was/is legal now will be illegal in the future, and that people/companies throughout history will always submit to the costs of regulatory compliance of all governments in the world, no matter how burdensome they may be in specific instances.

yuhong 9y ago

I have been thinking that the ad bubble is a problem for a while now. Ads are basically to encourage consumption, and the US economy has been debt based for decades now.

davidgerard 9y ago

We [technology dept at a non-computer business in the UK] got the lecture about this at work. Turns out geeks are fans of this approach! I've been using "GDPR hazard" as a useful way to kill bad ideas at work. "Sure you can do that! We just need you to confirm that your business unit accepts responsibility for this user-identifying data and ... oh, we can delete it? I'll do that now then." We have lots of user-identified data, going back years. I can't see it as a bad thing for us to behave properly with regard to it, and to be required to do so.

andrei_says_ 9y ago

Just wondering, would an European residing in the US be able to request EU compliance for their data?

mdip 9y ago

My first instinct was to be pretty happy about these laws, which surprised me quite a bit. I generally identify on the libertarian/pro-capitalist side of things and "as a general rule" subscribe to the belief that government regulations are often more problematic than problem solving[0]. So I had to take a moment to analyse why I felt this way. Here's the problem as I see it: I know all of the things that are collected, how they're collected, what shady practices are used[1] and I'm completely aware that there is no anonymity left on the internet. The old "when the product is free, you're the product" isn't lost on me. In reading this, though, I was still finding myself a little outraged[2]. I look at it this way: if yesterday, we had an web with plain old "dumb advertising" techniques limited in sophistication in the manner of television advertising in the 90s, and today we ended up with this, there would be rioting (in the USA, anyway[3]). This didn't necessarily happen slowly but it happened gradually and quietly. I remember when Facebook announced that it was adding the ability to track you on other sites that you visited while you were logged out -- that was announced and it was met with criticism (briefly, though I quit the platform about a month later in a quiet, personal, revolt). Here's the thing - if you ask an average non-technical individual if they understand that they're being tracked on the internet, they'll shrug and say "yes". If you dig a little deeper, you'll discover that they haven't the faintest idea how deeply they're being tracked and that they don't even have an analogy in their own lives to equate that tracking to. I couldn't come up with anything to describe the extent of tracking short of extremely lengthy explanations of what's being done and used[4]. And then there's me - I understand I'm being tracked and have basically chosen the head-in-the-sand approach. I use adblock, and a few extensions that supposedly "limit tracking" (doubtful) but I know they're worthless. Here's the thing, though, what choice do we have? And that's where I concluded how I was able to land in favor of some form of regulation on this behavior[5]. It is becoming increasingly impossible to avoid interacting with companies like Google and Facebook[6]. I look at it this way -- a company that becomes a monopoly in such an important industry can exert as much, if not more, control over the citizenry than their own government[7] but without the limitations imposed by democracy. What should be done? I'm not sure. Self-regulation isn't working. I have zero faith in government crafting any kind of law related to technology that won't be some combination of horribly ineffective, worse than what we have today, utterly breaks something really important, or is used as a means to insert something horrible (watch them try to pop in a line-item around key-escrow). I'm kind of surprised to find myself thinking that approach that looks the best, out of the options, is probably forced-competition through breaking up the companies involved and I hate that idea in principal and in practice -- it's worked just-about as well in the past. [0] I don't want this to devolve into a flame-war of whether regulating is "good or not", though I fear I may have just stoked that flame, I'm simply providing background for contextual purposes. [1] I half- admire the creative uses of WebRTC with STUN on what are otherwise regarded as highly reputable major news sites. It's difficult for me to not see that practice as poking a hole in my firewall and I feel no less outrage when I see that happening than I do when a piece of malware does the same thing. [2] Part of me had forgotten the idea that when GMail was "scanning e-mails for advertising purposes", they were scanning e-mails that were coming inbound from non-GMail users who couldn't have possibly consented to that. I'm sure there's a really good counter argument, but I'd have a hard time not feeling a little violated by that practice if I weren't a GMail user, already. [3] Probably elsewhere, but my experience is that some European countries' citizens (particularly the UK, where I have the most experience outside of the US) are more tolerant to this sort of thing whereas when I was a child, you'd have seen people gathering in militias the moment the government tried to propose something like Real ID. [4] I can only speak anecdotally since I had this conversation with family members who are non-technical and after about two hours, had them quite disgusted -- asking how is that legal ... and these are some of the most government-skeptical conservative people you'd ever meet. [5] And I have zero faith in the US government being able to craft a law that works. Minimally the "they must still offer the service if the user opts out" will be removed, entirely, turning the "agree to be tracked" button into the moral equivalent of the "Cookie Warning" -- something you click because you have to. And philosophically, if we weren't talking about monopolies or near-monopolies here, I'd agree with that approach. [6] Yes, DuckDuckGo is my default search engine, everywhere. And I've now trained myself to use the shortcut to get to google for the 60-70% of searches that DDG returns unworkable results. I think it's my search patterns, which tend to be very narrow in results, causing Bing/DDG to "broaden" and ignore terms (or when used with parameters, simply yield nothing). My parents (both retired) use DDG and rarely anything else since I switched all of their browsers around (they didn't even realize I had changed it -- they don't think of Google as a company, they think of search as something "the internet just has ..."). They are perfectly happy with it. [7] Or can work in concert with it. Requirements to hand over Facebook credentials at the border are becoming common. I'm waiting for the day when I say "yeah, I don't use that" and end up back in a little room with an angry looking man asking me a bunch of (the same; slightly rephrased) questions and responding to them with the assumption that I'm lying (personal experience on that one; not fun). I mean, after all, I'm a programmer/live on the internet/et. al., surely I must use Facebook and I'm trying to hide something! /s

mzzter 9y ago

What does the first footnote mean? > "Nor can they deny access to their services to users who refuse to opt-in to tracking.[1]" > "[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1. See Recital 42’s reference to “without detriment”, Recital 43’s discussion of “freely given” consent, and Article 7(2) prohibition of conditionality. See also the UK Information Commissioner’s Office’s draft guidance on consent, 31 March 2017, p. 21, which clearly prohibits so-called “tracking walls”." What, in this regulation, prevents the company from denying users (who opt out) access to a service they provide free of charge or a downgraded experience? And how would a court measure the level of service?

taysic 9y ago
Im guessing they would force the company to make tracking not on by default but rather opt-in (lol)? But what's confusing is - if you clearly state how the data will be used upfront, do you need to offer an opt-out? What if your service simply doesn't work unless the data is used in a particular way?
- grabeh 9y ago
  Under the GDPR one way to use data for purposes unrelated to the underlying service provision is to look to obtain consent. That is not opt-out consent but clear informed consent through opt-in. If your service won't work functionally without certain data then consent is not right ground of processing to rely on. There is a specific ground relating to processing necessary to provide a service. If your service isn't financially viable because you can't use data to obtain revenue to support the underlying service provision then consent may not be a viable ground because of the above reasons. The debate continues however on how to support free service provision outside of the confines of consent.
  - taysic 9y ago
    Interesting but complex. I could imagine there are a lot of issues on how to express your intent with the data. Some uses of data might be ancillary to the direct goal of the user but still unexpectedly useful. Interesting from the article: "purpose that is vague or general, such as for instance ‘Improving users’ experience’, ‘marketing purposes’, or ‘future research’ will – without further detail – usually not meet the criteria of being ‘specific’”.[3]"

deleted 9y ago

[deleted]

fnord77 9y ago

I need to move to europe.

whyagaindavid 9y ago

Will GDPR allow me to delete my Apple-ID? Thanks

virgilp 9y ago
yes

throwaway91234 9y ago

Throwaway since I don't want to involve my employer. I actually work for a platform that is squarely in the GDPR crosshairs (digital marketing). There are a lot of things where our lawyers' perspective is different from what most people say here (I didn't talk directly to lawyers, but I presume product managers did). - You don't have to comply in 2018, you have to show that you started seriously working on a solution, even if you're not fully prepared. - You don't have to have automated processes for everything (e.g. delete from backups), it's actually perfectly reasonable to say "we'll process your request" and do it manually (ref: startups spending inordinate amounts of effort for GDPR compliance). - Opt-in is not as "game changer" as suggested here, my understanding is that you can do implicit consent (notify the user about what you do, give them a link to take action; crucially, that link might even be the link to your privacy policy which contains the link to the opt-out interface... if I got this right - and I think that I did - this may not amount to much more than a slightly modified "this site uses cookies" thingy). - Delete requests may be handled by "de-identification" (don't delete the data, delete the association with you). - Related to that, while I don't have a definitive answer, I strongly suspect that GDPR only applies to information that can be positively associated with you (e.g. authenticated activity). I'm not obliged to show you anonymous browser activity/information that I've probabilistically associated with you, for the simple reason that I might be wrong and I might disclose sensitive information (think about girlfriend looking up "what does Amazon know about me" and finding up that "she is interested in an engagement ring" because you anonymously browsed from her computer, thus spoiling your surprise even though you were careful to delete your browser history/ browse anonymously. Yes, incognito mode doesn't necessarily help you - we do efforts to identify server-side the incognito sessions and de-link them from the probabilistic marketing profiles, because we don't want to negatively-surprise the customers; but I suspect not all players are that careful). Overall... despite what many people think, I think big players are actually fairly careful/sensitive about your privacy (well, if we exclude Facebook here :D ). It's the startups that would concern me more... they have very little incentive to guard your data well, because there are so many OTHER reasons why they might fail, that "privacy disaster" is very low on their list of concerns.

1024core 9y ago

So, are ad clicks "personal data" ? That would basically destroy all adtech startups.

brango 9y ago
Yes, if you capture IPs/anonymous user IDs, perhaps user agents etc.
gonmf 9y ago
I'd imagine the host website needs to ask for the permission to share specific data with a third party named XYZ Startup, that will use that data for language/country segmentation or whatever is they do, and if the user denies that right then random ads are shown instead.

AriaMinaei 9y ago

While I see some of the concerns about the _technicality_ of the law as completely legitimate, it still bothers me that so many people reject the whole spirit of this law, and cannot put the negative of "tax on startups" against the much greater good of personal privacy. I've just started a business myself, and this regulation affects my company too. It makes development costlier; it'll take from the precious little time we have to spend on compliance paperwork rather than work on our core business. In the short run, it does hurt our chances of success. Yet, none of the trouble is even comparable to what's to be gained here. And it bothers me (though doesn't surprise me) that some people don't see that. It also bothers me that such vocal opposition barely comes up when the discussion is just about bigger companies such as Google and Facebook. How can we expect "un-evilness" from bigger companies when we're barely willing to do anything in that regard ourselves?

fixermark 9y ago
Possibly because personal privacy as a "much greater good" is open to debate. People place wildly differing values on that property. Google's current ecosystem of data-sharing means that Assistant can make educated context guesses on what I mean when I talk to it based on my browser history and map navigation history. If the new privacy constraints damage that passive interconnection, that's not a net good for me.
- the_mitsuhiko 9y ago
  Then opt into collection. This does not disallow that.
- AriaMinaei 9y ago
  > ... privacy as a "much greater good" is open to debate I agree, but that's a different topic, really. The comments here aren't about the (un)/importance of privacy. The main debate seems to be either about the technicality of the law and its possible unintended consequences, which are legitimate concerns, or they're about how "this is gonna make my job much harder," which is not really a legitimate concern in this context, and those comments were the ones I was talking about. > Google's current ecosystem of data-sharing means that Assistant can make educated context guesses on what I mean when I talk to it based on my browser history and map navigation history. If the new privacy constraints damage that passive interconnection, that's not a net good for me. I think we're overestimating a technical difficulty here, and downplaying a moral principle. Providing a personalised service without storing large amounts of personal information in a central location is not impossible. It's just technically harder to do. And even if it was impossible, then still, we need to sort out the moral consequences first. Not by banning technological progress of course, but perhaps by bringing more oversight to corporations. Or by making sure that people of lower socioeconomic background aren't hit harder than the wealthy.

sageikosa 9y ago

Cool. 88 more pages of functional specs on every project.

richrichardsson 9y ago

Would one way "around" this be, "Welcome to ABC Service, it costs X€/month to use, or if you allow us to use your data to sell to our advertisers we will waive this fee."?